I have a question about the Actions for the Recovery flow. The Recovery flow has two submits: (1) submit email; (2) submit recovery code. When do the before and after actions occur? Thanks.

I would assume after the whole flow is done, as that's what we basically have everywhere

So I’ve set up a flow-interrupting webhook for after recovery. When my endpoint responds with 403, the redirect after the form submit is to a new recovery flow, and this flow contains my custom error msg. But the user is still granted an Ory session. So the flow isn’t being blocked.

so the recovery flow gives you a session, but also an error?

Yes. The original flow seems to be successful. Then it starts a new flow with the error

how did you set-up the webhook? what is the config?

Through the new Actions UI. But the config looks correct to me:

"recovery": {
  "after": {
    "hooks": [
      {
        "config": {
          "auth": {
            "config": {
              "in": "header",
              "name": "Authorization",
              "value": "Bearer REDACTED"
            },
            "type": "api_key"
          },
          "body": "<https://storage.googleapis.com/bac-gcs-production/51c1912d59454d98f7d0ea2365809b52ef7d6f09f6f97ccf9363da95b7aa4a8ce396b349572762843dd43f325aa4ccb4e3e7ad3fa2ebc7ddf248cad84518b460.jsonnet>",
          "can_interrupt": false,
          "method": "POST",
          "response": {
            "ignore": false,
            "parse": true
          },
          "url": "<https://REDACTED/v1.0/webhooks/ory/recovery/after>"
        },
        "hook": "web_hook"
      }
    ]
  },
  "before": {
    "hooks": []
  },
  "enabled": true,
  "lifespan": "30m0s",
  "notify_unknown_recipients": true,
  "ui_url": "/ui/recovery",
  "use": "code"
},

yes looks correct from a first look, maybe there is a bug...

Thanks for looking into it. I should have searched github first. This is a blocker for us. The Recovery flow allows you to bypass signing in, and some of our users are only allowed to sign in using OIDC. So we must prevent them from using recovery. Should I create an issue in ory/network too? Those issues seem to get a bit more attention. I may look at submitting a PR with the fix. Can you please point me to the file where the recovery hooks are implemented?

You find all relevant code under

selfservice/flows/recovery

It should be a fairly manageable change, you can compare the code to registration as it works there

Thanks. I’ll take a look.

hm but are you sure it works for login?

Yes, it works for login

yes that's it, it is later activated https://github.com/ory/kratos/blob/53080b0bd7fc3df9c85d87b119e878af7d040232/selfservice/flow/login/hook.go#L131 https://github.com/ory/kratos/blob/53080b0bd7fc3df9c85d87b119e878af7d040232/selfservice/flow/login/hook.go#L185

Or just move the

PostRecoveryHook

call above this line? https://github.com/ory/kratos/blob/master/selfservice/strategy/code/strategy_recovery.go#L377

I think you still have to split the hooks, so run some before that, and some after

registration has

PostRegistrationPrePersistHook

and

PostRegistrationPostPersistHook

. But login only has one post hook.

so if it is

parse: true

it automatically interrupts on errors? otherwise it runs async and cannot interrupt?

exactly

so should be fine to just move

Now I just need to get the Kratos dev env running

go test -tags sqlite,json1 -short -failfast ./...

should be enough

Is it possible to have someone review this PR: https://github.com/ory/kratos/pull/3393

sure, sorry, lost track of it

thanks